nvidia-nat 1.3.0a20250910__py3-none-any.whl → 1.4.0a20251112__py3-none-any.whl

nat/agent/rewoo_agent/register.py

@@ -23,41 +23,38 @@ from nat.builder.builder import Builder
 from nat.builder.framework_enum import LLMFrameworkEnum
 from nat.builder.function_info import FunctionInfo
 from nat.cli.register_workflow import register_function
+from nat.data_models.agent import AgentBaseConfig
 from nat.data_models.api_server import ChatRequest
+from nat.data_models.api_server import ChatRequestOrMessage
 from nat.data_models.api_server import ChatResponse
+from nat.data_models.api_server import Usage
+from nat.data_models.component_ref import FunctionGroupRef
 from nat.data_models.component_ref import FunctionRef
-from nat.data_models.component_ref import LLMRef
-from nat.data_models.function import FunctionBaseConfig
 from nat.utils.type_converter import GlobalTypeConverter
 
 logger = logging.getLogger(__name__)
 
 
-class ReWOOAgentWorkflowConfig(FunctionBaseConfig, name="rewoo_agent"):
+class ReWOOAgentWorkflowConfig(AgentBaseConfig, name="rewoo_agent"):
     """
     Defines a NAT function that uses a ReWOO Agent performs reasoning inbetween tool calls, and utilizes the
     tool names and descriptions to select the optimal tool.
     """
-
-    tool_names: list[FunctionRef] = Field(default_factory=list,
-                                          description="The list of tools to provide to the rewoo agent.")
-    llm_name: LLMRef = Field(description="The LLM model to use with the rewoo agent.")
-    verbose: bool = Field(default=False, description="Set the verbosity of the rewoo agent's logging.")
+    description: str = Field(default="ReWOO Agent Workflow", description="The description of this functions use.")
+    tool_names: list[FunctionRef | FunctionGroupRef] = Field(
+        default_factory=list, description="The list of tools to provide to the rewoo agent.")
     include_tool_input_schema_in_tool_description: bool = Field(
         default=True, description="Specify inclusion of tool input schemas in the prompt.")
-    description: str = Field(default="ReWOO Agent Workflow", description="The description of this functions use.")
     planner_prompt: str | None = Field(
         default=None,
         description="Provides the PLANNER_PROMPT to use with the agent")  # defaults to PLANNER_PROMPT in prompt.py
     solver_prompt: str | None = Field(
         default=None,
         description="Provides the SOLVER_PROMPT to use with the agent")  # defaults to SOLVER_PROMPT in prompt.py
+    tool_call_max_retries: PositiveInt = Field(default=3,
+                                               description="The number of retries before raising a tool call error.",
+                                               ge=1)
     max_history: int = Field(default=15, description="Maximum number of messages to keep in the conversation history.")
-    log_response_max_chars: PositiveInt = Field(
-        default=1000, description="Maximum number of characters to display in logs when logging tool responses.")
-    use_openai_api: bool = Field(default=False,
-                                 description=("Use OpenAI API for the input/output types to the function. "
-                                              "If False, strings will be used."))
     additional_planner_instructions: str | None = Field(
         default=None,
         validation_alias=AliasChoices("additional_planner_instructions", "additional_instructions"),
@@ -65,12 +62,16 @@ class ReWOOAgentWorkflowConfig(FunctionBaseConfig, name="rewoo_agent"):
     additional_solver_instructions: str | None = Field(
         default=None,
         description="Additional instructions to provide to the agent in addition to the base solver prompt.")
+    raise_tool_call_error: bool = Field(default=True,
+                                        description="Whether to raise a exception immediately if a tool"
+                                        "call fails. If set to False, the tool call error message will be included in"
+                                        "the tool response and passed to the next tool.")
 
 
 @register_function(config_type=ReWOOAgentWorkflowConfig, framework_wrappers=[LLMFrameworkEnum.LANGCHAIN])
 async def rewoo_agent_workflow(config: ReWOOAgentWorkflowConfig, builder: Builder):
-    from langchain.schema import BaseMessage
     from langchain_core.messages import trim_messages
+    from langchain_core.messages.base import BaseMessage
     from langchain_core.messages.human import HumanMessage
     from langchain_core.prompts import ChatPromptTemplate
     from langgraph.graph.state import CompiledStateGraph
@@ -106,7 +107,7 @@ async def rewoo_agent_workflow(config: ReWOOAgentWorkflowConfig, builder: Builde
 
     # the agent can run any installed tool, simply install the tool and add it to the config file
     # the sample tool provided can easily be copied or changed
-    tools = builder.get_tools(tool_names=config.tool_names, wrapper_type=LLMFrameworkEnum.LANGCHAIN)
+    tools = await builder.get_tools(tool_names=config.tool_names, wrapper_type=LLMFrameworkEnum.LANGCHAIN)
     if not tools:
         raise ValueError(f"No tools specified for ReWOO Agent '{config.llm_name}'")
 
@@ -118,12 +119,27 @@ async def rewoo_agent_workflow(config: ReWOOAgentWorkflowConfig, builder: Builde
         tools=tools,
         use_tool_schema=config.include_tool_input_schema_in_tool_description,
         detailed_logs=config.verbose,
-        log_response_max_chars=config.log_response_max_chars).build_graph()
+        log_response_max_chars=config.log_response_max_chars,
+        tool_call_max_retries=config.tool_call_max_retries,
+        raise_tool_call_error=config.raise_tool_call_error).build_graph()
+
+    async def _response_fn(chat_request_or_message: ChatRequestOrMessage) -> ChatResponse | str:
+        """
+        Main workflow entry function for the ReWOO Agent.
+
+        This function invokes the ReWOO Agent Graph and returns the response.
+
+        Args:
+            chat_request_or_message (ChatRequestOrMessage): The input message to process
 
-    async def _response_fn(input_message: ChatRequest) -> ChatResponse:
+        Returns:
+            ChatResponse | str: The response from the agent or error message
+        """
         try:
+            message = GlobalTypeConverter.get().convert(chat_request_or_message, to_type=ChatRequest)
+
             # initialize the starting state with the user query
-            messages: list[BaseMessage] = trim_messages(messages=[m.model_dump() for m in input_message.messages],
+            messages: list[BaseMessage] = trim_messages(messages=[m.model_dump() for m in message.messages],
                                                         max_tokens=config.max_history,
                                                         strategy="last",
                                                         token_counter=len,
@@ -139,24 +155,21 @@ async def rewoo_agent_workflow(config: ReWOOAgentWorkflowConfig, builder: Builde
             # get and return the output from the state
             state = ReWOOGraphState(**state)
             output_message = state.result.content
-            return ChatResponse.from_string(output_message)
-
+            # Ensure output_message is a string
+            if isinstance(output_message, list | dict):
+                output_message = str(output_message)
+
+            # Create usage statistics for the response
+            prompt_tokens = sum(len(str(msg.content).split()) for msg in message.messages)
+            completion_tokens = len(output_message.split()) if output_message else 0
+            total_tokens = prompt_tokens + completion_tokens
+            usage = Usage(prompt_tokens=prompt_tokens, completion_tokens=completion_tokens, total_tokens=total_tokens)
+            response = ChatResponse.from_string(output_message, usage=usage)
+            if chat_request_or_message.is_string:
+                return GlobalTypeConverter.get().convert(response, to_type=str)
+            return response
         except Exception as ex:
-            logger.exception("ReWOO Agent failed with exception: %s", ex)
-            # here, we can implement custom error messages
-            if config.verbose:
-                return ChatResponse.from_string(str(ex))
-            return ChatResponse.from_string("I seem to be having a problem.")
-
-    if (config.use_openai_api):
-        yield FunctionInfo.from_fn(_response_fn, description=config.description)
-
-    else:
-
-        async def _str_api_fn(input_message: str) -> str:
-            oai_input = GlobalTypeConverter.get().try_convert(input_message, to_type=ChatRequest)
-            oai_output = await _response_fn(oai_input)
-
-            return GlobalTypeConverter.get().try_convert(oai_output, to_type=str)
+            logger.error("ReWOO Agent failed with exception: %s", ex)
+            raise
 
-        yield FunctionInfo.from_fn(_str_api_fn, description=config.description)
+    yield FunctionInfo.from_fn(_response_fn, description=config.description)

nat/agent/tool_calling_agent/agent.py

@@ -19,10 +19,13 @@ import typing
 from langchain_core.callbacks.base import AsyncCallbackHandler
 from langchain_core.language_models import BaseChatModel
 from langchain_core.messages import SystemMessage
+from langchain_core.messages import ToolMessage
 from langchain_core.messages.base import BaseMessage
 from langchain_core.runnables import RunnableLambda
 from langchain_core.runnables.config import RunnableConfig
 from langchain_core.tools import BaseTool
+from langgraph.graph import StateGraph
+from langgraph.graph.state import CompiledStateGraph
 from langgraph.prebuilt import ToolNode
 from pydantic import BaseModel
 from pydantic import Field
@@ -57,12 +60,14 @@ class ToolCallAgentGraph(DualNodeAgent):
         detailed_logs: bool = False,
         log_response_max_chars: int = 1000,
         handle_tool_errors: bool = True,
+        return_direct: list[BaseTool] | None = None,
     ):
         super().__init__(llm=llm,
                          tools=tools,
                          callbacks=callbacks,
                          detailed_logs=detailed_logs,
                          log_response_max_chars=log_response_max_chars)
+
         # some LLMs support tool calling
         # these models accept the tool's input schema and decide when to use a tool based on the input's relevance
         try:
@@ -85,8 +90,8 @@ class ToolCallAgentGraph(DualNodeAgent):
             )
 
         self.agent = prompt_runnable | self.bound_llm
-
         self.tool_caller = ToolNode(tools, handle_tool_errors=handle_tool_errors)
+        self.return_direct = [tool.name for tool in return_direct] if return_direct else []
         logger.debug("%s Initialized Tool Calling Agent Graph", AGENT_LOG_PREFIX)
 
     async def agent_node(self, state: ToolCallAgentGraphState):
@@ -146,13 +151,70 @@ class ToolCallAgentGraph(DualNodeAgent):
             logger.error("%s Failed to call tool_node: %s", AGENT_LOG_PREFIX, ex)
             raise
 
-    async def build_graph(self):
+    async def tool_conditional_edge(self, state: ToolCallAgentGraphState) -> AgentDecision:
+        """
+        Determines whether to continue to the agent or end graph execution after a tool call.
+
+        Args:
+            state: The current state of the Tool Calling Agent graph containing messages and tool responses.
+
+        Returns:
+            AgentDecision: TOOL to continue to agent for processing, or END to terminate graph execution.
+            Returns END if the tool is in return_direct list, otherwise returns TOOL to continue processing.
+        """
         try:
-            await super()._build_graph(state_schema=ToolCallAgentGraphState)
-            logger.debug(
-                "%s Tool Calling Agent Graph built and compiled successfully",
-                AGENT_LOG_PREFIX,
-            )
+            logger.debug("%s Starting the Tool Conditional Edge", AGENT_LOG_PREFIX)
+            if not state.messages:
+                logger.debug("%s No messages in state; routing to agent", AGENT_LOG_PREFIX)
+                return AgentDecision.TOOL
+
+            last_message = state.messages[-1]
+            # Return directly if this tool is in the return_direct set
+            if (self.return_direct and isinstance(last_message, ToolMessage) and last_message.name
+                    and last_message.name in self.return_direct):
+                # Return directly if this tool is in the return_direct list
+                logger.debug("%s Tool %s is set to return directly", AGENT_LOG_PREFIX, last_message.name)
+                return AgentDecision.END
+            else:
+                # Continue to agent for processing
+                logger.debug("%s Tool response will be processed by agent", AGENT_LOG_PREFIX)
+                return AgentDecision.TOOL
+        except Exception as ex:
+            logger.exception("%s Failed to determine tool conditional edge: %s", AGENT_LOG_PREFIX, ex)
+            logger.warning("%s Continuing to agent for processing", AGENT_LOG_PREFIX)
+            return AgentDecision.TOOL
+
+    async def _build_graph(self, state_schema: type) -> CompiledStateGraph:
+        try:
+            logger.debug("%s Building and compiling the Tool Calling Agent Graph", AGENT_LOG_PREFIX)
+
+            graph = StateGraph(state_schema)
+            graph.add_node("agent", self.agent_node)
+            graph.add_node("tool", self.tool_node)
+
+            if self.return_direct:
+                # go to end of graph if tool is set to return directly
+                tool_conditional_edge_possible_outputs = {AgentDecision.END: "__end__", AgentDecision.TOOL: "agent"}
+                graph.add_conditional_edges("tool", self.tool_conditional_edge, tool_conditional_edge_possible_outputs)
+            else:
+                # otherwise return to agent after tool call
+                graph.add_edge("tool", "agent")
+
+            conditional_edge_possible_outputs = {AgentDecision.TOOL: "tool", AgentDecision.END: "__end__"}
+            graph.add_conditional_edges("agent", self.conditional_edge, conditional_edge_possible_outputs)
+
+            graph.set_entry_point("agent")
+            self.graph = graph.compile()
+
+            return self.graph
+        except Exception as ex:
+            logger.error("%s Failed to build Tool Calling Agent Graph: %s", AGENT_LOG_PREFIX, ex)
+            raise
+
+    async def build_graph(self) -> CompiledStateGraph:
+        try:
+            await self._build_graph(state_schema=ToolCallAgentGraphState)
+            logger.debug("%s Tool Calling Agent Graph built and compiled successfully", AGENT_LOG_PREFIX)
             return self.graph
         except Exception as ex:
             logger.error("%s Failed to build Tool Calling Agent Graph: %s", AGENT_LOG_PREFIX, ex)
@@ -171,14 +233,10 @@ def create_tool_calling_agent_prompt(config: "ToolCallAgentWorkflowConfig") -> s
     """
     # the Tool Calling Agent prompt can be customized via config option system_prompt and additional_instructions.
 
-    if config.system_prompt:
-        prompt_str = config.system_prompt
-    else:
-        prompt_str = ""
-
-    if config.additional_instructions:
-        prompt_str += f" {config.additional_instructions}"
-
-    if len(prompt_str) > 0:
-        return prompt_str
+    prompt_strs = []
+    for msg in [config.system_prompt, config.additional_instructions]:
+        if msg is not None:
+            prompt_strs.append(msg)
+    if prompt_strs:
+        return " ".join(prompt_strs)
     return None

nat/agent/tool_calling_agent/register.py

@@ -16,42 +16,44 @@
 import logging
 
 from pydantic import Field
-from pydantic import PositiveInt
 
 from nat.builder.builder import Builder
 from nat.builder.framework_enum import LLMFrameworkEnum
 from nat.builder.function_info import FunctionInfo
 from nat.cli.register_workflow import register_function
+from nat.data_models.agent import AgentBaseConfig
+from nat.data_models.api_server import ChatRequest
+from nat.data_models.api_server import ChatRequestOrMessage
+from nat.data_models.component_ref import FunctionGroupRef
 from nat.data_models.component_ref import FunctionRef
-from nat.data_models.component_ref import LLMRef
-from nat.data_models.function import FunctionBaseConfig
+from nat.utils.type_converter import GlobalTypeConverter
 
 logger = logging.getLogger(__name__)
 
 
-class ToolCallAgentWorkflowConfig(FunctionBaseConfig, name="tool_calling_agent"):
+class ToolCallAgentWorkflowConfig(AgentBaseConfig, name="tool_calling_agent"):
     """
     A Tool Calling Agent requires an LLM which supports tool calling. A tool Calling Agent utilizes the tool
     input parameters to select the optimal tool.  Supports handling tool errors.
     """
-
-    tool_names: list[FunctionRef] = Field(default_factory=list,
-                                          description="The list of tools to provide to the tool calling agent.")
-    llm_name: LLMRef = Field(description="The LLM model to use with the tool calling agent.")
-    verbose: bool = Field(default=False, description="Set the verbosity of the tool calling agent's logging.")
-    handle_tool_errors: bool = Field(default=True, description="Specify ability to handle tool calling errors.")
     description: str = Field(default="Tool Calling Agent Workflow", description="Description of this functions use.")
+    tool_names: list[FunctionRef | FunctionGroupRef] = Field(
+        default_factory=list, description="The list of tools to provide to the tool calling agent.")
+    handle_tool_errors: bool = Field(default=True, description="Specify ability to handle tool calling errors.")
     max_iterations: int = Field(default=15, description="Number of tool calls before stoping the tool calling agent.")
-    log_response_max_chars: PositiveInt = Field(
-        default=1000, description="Maximum number of characters to display in logs when logging tool responses.")
+    max_history: int = Field(default=15, description="Maximum number of messages to keep in the conversation history.")
+
     system_prompt: str | None = Field(default=None, description="Provides the system prompt to use with the agent.")
     additional_instructions: str | None = Field(default=None,
                                                 description="Additional instructions appended to the system prompt.")
+    return_direct: list[FunctionRef] | None = Field(
+        default=None, description="List of tool names that should return responses directly without LLM processing.")
 
 
 @register_function(config_type=ToolCallAgentWorkflowConfig, framework_wrappers=[LLMFrameworkEnum.LANGCHAIN])
 async def tool_calling_agent_workflow(config: ToolCallAgentWorkflowConfig, builder: Builder):
-    from langchain_core.messages.human import HumanMessage
+    from langchain_core.messages import trim_messages
+    from langchain_core.messages.base import BaseMessage
     from langgraph.graph.state import CompiledStateGraph
 
     from nat.agent.base import AGENT_LOG_PREFIX
@@ -64,23 +66,46 @@ async def tool_calling_agent_workflow(config: ToolCallAgentWorkflowConfig, build
     llm = await builder.get_llm(config.llm_name, wrapper_type=LLMFrameworkEnum.LANGCHAIN)
     # the agent can run any installed tool, simply install the tool and add it to the config file
     # the sample tools provided can easily be copied or changed
-    tools = builder.get_tools(tool_names=config.tool_names, wrapper_type=LLMFrameworkEnum.LANGCHAIN)
+    tools = await builder.get_tools(tool_names=config.tool_names, wrapper_type=LLMFrameworkEnum.LANGCHAIN)
     if not tools:
         raise ValueError(f"No tools specified for Tool Calling Agent '{config.llm_name}'")
 
+    # convert return_direct FunctionRef objects to BaseTool objects
+    return_direct_tools = await builder.get_tools(
+        tool_names=config.return_direct, wrapper_type=LLMFrameworkEnum.LANGCHAIN) if config.return_direct else None
+
     # construct the Tool Calling Agent Graph from the configured llm, and tools
     graph: CompiledStateGraph = await ToolCallAgentGraph(llm=llm,
                                                          tools=tools,
                                                          prompt=prompt,
                                                          detailed_logs=config.verbose,
                                                          log_response_max_chars=config.log_response_max_chars,
-                                                         handle_tool_errors=config.handle_tool_errors).build_graph()
+                                                         handle_tool_errors=config.handle_tool_errors,
+                                                         return_direct=return_direct_tools).build_graph()
 
-    async def _response_fn(input_message: str) -> str:
+    async def _response_fn(chat_request_or_message: ChatRequestOrMessage) -> str:
+        """
+        Main workflow entry function for the Tool Calling Agent.
+
+        This function invokes the Tool Calling Agent Graph and returns the response.
+
+        Args:
+            chat_request_or_message (ChatRequestOrMessage): The input message to process
+
+        Returns:
+            str: The response from the agent or error message
+        """
         try:
+            message = GlobalTypeConverter.get().convert(chat_request_or_message, to_type=ChatRequest)
+
             # initialize the starting state with the user query
-            input_message = HumanMessage(content=input_message)
-            state = ToolCallAgentGraphState(messages=[input_message])
+            messages: list[BaseMessage] = trim_messages(messages=[m.model_dump() for m in message.messages],
+                                                        max_tokens=config.max_history,
+                                                        strategy="last",
+                                                        token_counter=len,
+                                                        start_on="human",
+                                                        include_system=True)
+            state = ToolCallAgentGraphState(messages=messages)
 
             # run the Tool Calling Agent Graph
             state = await graph.ainvoke(state, config={'recursion_limit': (config.max_iterations + 1) * 2})
@@ -91,12 +116,10 @@ async def tool_calling_agent_workflow(config: ToolCallAgentWorkflowConfig, build
             # get and return the output from the state
             state = ToolCallAgentGraphState(**state)
             output_message = state.messages[-1]
-            return output_message.content
+            return str(output_message.content)
         except Exception as ex:
-            logger.exception("%s Tool Calling Agent failed with exception: %s", AGENT_LOG_PREFIX, ex)
-            if config.verbose:
-                return str(ex)
-            return "I seem to be having a problem."
+            logger.error("%s Tool Calling Agent failed with exception: %s", AGENT_LOG_PREFIX, ex)
+            raise
 
     try:
         yield FunctionInfo.from_fn(_response_fn, description=config.description)

nat/authentication/api_key/api_key_auth_provider.py

@@ -15,8 +15,6 @@
 
 import logging
 
-from pydantic import SecretStr
-
 from nat.authentication.api_key.api_key_auth_provider_config import APIKeyAuthProviderConfig
 from nat.authentication.interfaces import AuthProviderBase
 from nat.data_models.authentication import AuthResult
@@ -29,11 +27,10 @@ logger = logging.getLogger(__name__)
 class APIKeyAuthProvider(AuthProviderBase[APIKeyAuthProviderConfig]):
 
     # fmt: off
-    def __init__(self,
-                 config: APIKeyAuthProviderConfig,
-                 config_name: str | None = None) -> None:
+    def __init__(self, config: APIKeyAuthProviderConfig, config_name: str | None = None) -> None:
         assert isinstance(config, APIKeyAuthProviderConfig), ("Config is not APIKeyAuthProviderConfig")
         super().__init__(config)
+
     # fmt: on
 
     async def _construct_authentication_header(self) -> BearerTokenCred:
@@ -58,14 +55,12 @@ class APIKeyAuthProvider(AuthProviderBase[APIKeyAuthProviderConfig]):
         header_auth_scheme = config.auth_scheme
 
         if header_auth_scheme == HeaderAuthScheme.BEARER:
-            return BearerTokenCred(token=SecretStr(f"{config.raw_key}"),
+            return BearerTokenCred(token=config.raw_key,
                                    scheme=HeaderAuthScheme.BEARER.value,
                                    header_name=AUTHORIZATION_HEADER)
 
         if header_auth_scheme == HeaderAuthScheme.X_API_KEY:
-            return BearerTokenCred(token=SecretStr(f"{config.raw_key}"),
-                                   scheme=HeaderAuthScheme.X_API_KEY.value,
-                                   header_name='')
+            return BearerTokenCred(token=config.raw_key, scheme=HeaderAuthScheme.X_API_KEY.value, header_name='')
 
         if header_auth_scheme == HeaderAuthScheme.CUSTOM:
             if not config.custom_header_name:
@@ -74,13 +69,13 @@ class APIKeyAuthProvider(AuthProviderBase[APIKeyAuthProviderConfig]):
             if not config.custom_header_prefix:
                 raise ValueError('custom_header_prefix required when using header_auth_scheme=CUSTOM')
 
-            return BearerTokenCred(token=SecretStr(f"{config.raw_key}"),
+            return BearerTokenCred(token=config.raw_key,
                                    scheme=config.custom_header_prefix,
                                    header_name=config.custom_header_name)
 
         raise ValueError(f"Unsupported header auth scheme: {header_auth_scheme}")
 
-    async def authenticate(self, user_id: str | None = None) -> AuthResult | None:
+    async def authenticate(self, user_id: str | None = None, **kwargs) -> AuthResult | None:
         """
         Authenticate the user using the API key credentials.
 

nat/authentication/api_key/api_key_auth_provider_config.py

@@ -25,6 +25,7 @@ from nat.authentication.exceptions.api_key_exceptions import HeaderNameFieldErro
 from nat.authentication.exceptions.api_key_exceptions import HeaderPrefixFieldError
 from nat.data_models.authentication import AuthProviderBaseConfig
 from nat.data_models.authentication import HeaderAuthScheme
+from nat.data_models.common import SerializableSecretStr
 
 logger = logging.getLogger(__name__)
 
@@ -37,8 +38,9 @@ class APIKeyAuthProviderConfig(AuthProviderBaseConfig, name="api_key"):
     API Key authentication configuration model.
     """
 
-    raw_key: str = Field(description=("Raw API token or credential to be injected into the request parameter. "
-                                      "Used for 'bearer','x-api-key','custom', and other schemes. "))
+    raw_key: SerializableSecretStr = Field(
+        description=("Raw API token or credential to be injected into the request parameter. "
+                     "Used for 'bearer','x-api-key','custom', and other schemes. "))
 
     auth_scheme: HeaderAuthScheme = Field(default=HeaderAuthScheme.BEARER,
                                           description=("The HTTP authentication scheme to use. "
@@ -53,7 +55,7 @@ class APIKeyAuthProviderConfig(AuthProviderBaseConfig, name="api_key"):
 
     @field_validator('raw_key')
     @classmethod
-    def validate_raw_key(cls, value: str) -> str:
+    def validate_raw_key(cls, value: SerializableSecretStr) -> SerializableSecretStr:
         if not value:
             raise APIKeyFieldError('value_missing', 'raw_key field value is required.')
 
@@ -63,11 +65,12 @@ class APIKeyAuthProviderConfig(AuthProviderBaseConfig, name="api_key"):
                 'raw_key field value must be at least 8 characters long for security. '
                 f'Got: {len(value)} characters.')
 
-        if len(value.strip()) != len(value):
+        str_value = value.get_secret_value()
+        if len(str_value.strip()) != len(value):
             raise APIKeyFieldError('whitespace_found',
                                    'raw_key field value cannot have leading or trailing whitespace.')
 
-        if any(c in string.whitespace for c in value):
+        if any(c in string.whitespace for c in str_value):
             raise APIKeyFieldError('contains_whitespace', 'raw_key must not contain any '
                                    'whitespace characters.')
 

nat/authentication/credential_validator/__init__.py

@@ -0,0 +1,14 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.